93d3e0f3a28cf6b91a68b2ad97c89d50f4f7524735c353fd6143a350d10e71d0

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 00:55

Target

4c26aee4785d333ac97df700f7e66033_JaffaCakes118.dll
Size

37KB
MD5

4c26aee4785d333ac97df700f7e66033
SHA1

8ec20f214adcfab238c4f068fb1d07bd139768f8
SHA256

93d3e0f3a28cf6b91a68b2ad97c89d50f4f7524735c353fd6143a350d10e71d0
SHA512

2c9ce3f226586a01ee6d07d79f70d8ceee321678a13d7b1891e8895b4ab1566163de10de586e9e433a7adb7b71a24e356cc4feafc2408da03d61e5b66377fd51
SSDEEP

768:af4DeMKAPgXFLEZY4D1VaykZIXZh2EGksChaydOzLA:af4DeMKAPgVWpQIn2EZpOzLA

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2648	3008	rundll32.exe	30
PID 3008 wrote to memory of 2648	3008	rundll32.exe	30
PID 3008 wrote to memory of 2648	3008	rundll32.exe	30
PID 3008 wrote to memory of 2648	3008	rundll32.exe	30
PID 3008 wrote to memory of 2648	3008	rundll32.exe	30
PID 3008 wrote to memory of 2648	3008	rundll32.exe	30
PID 3008 wrote to memory of 2648	3008	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c26aee4785d333ac97df700f7e66033_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c26aee4785d333ac97df700f7e66033_JaffaCakes118.dll,#1
  2⤵
  PID:2648

memory/2648-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/2648-1-0x0000000000170000-0x0000000000175000-memory.dmp

Filesize
20KB

Download